Workplace health and safety legislation in Australia places a clear duty on businesses to identify, assess, and control the risks their workers face. A WHS risk register is the primary tool for meeting that duty in a structured, documented way. It’s not just a compliance document — it’s the operational foundation of your workplace safety management system.
This guide covers everything you need to build and maintain an effective WHS risk register: how to identify hazards, how to assess risks using the right methodology, how to apply the hierarchy of controls, how to document your outcomes, and how to adapt your approach to the specific WHS legislation in your state or territory.
What Is a WHS Risk Register?
A WHS risk register is a structured record of the workplace hazards your organisation has identified, the risks those hazards create, the controls currently in place to manage them, and the residual risk that remains after controls are applied. It’s the documented output of your hazard identification and risk assessment process.
Under the Work Health and Safety Act 2011 (Commonwealth, and adopted in most Australian states and territories), persons conducting a business or undertaking (PCBUs) have a primary duty of care to ensure, so far as is reasonably practicable, the health and safety of workers and other persons at the workplace. The WHS risk register is how that duty is demonstrated in practice — it shows that you’ve systematically identified the hazards your workers face and put controls in place to manage them.
The WHS risk register sits within the broader framework of an OHS/WHS management system. It is distinct from a general business risk register (which covers strategic, financial, reputational, and other non-safety risks) but follows similar principles: identify, assess, control, and review. For a comprehensive overview of risk registers in the broader business context, see What Is a Risk Register? The Complete Guide for Australian Businesses.
Step 1: Hazard Identification
You can’t assess or control a risk you haven’t identified. Hazard identification is the foundation of your WHS risk register, and it needs to be systematic — not a one-time exercise, but an ongoing process embedded in your operations.
Workplace hazards fall into several categories: physical hazards (slips, trips, falls, manual handling, working at heights, plant and machinery, noise, vibration, temperature extremes); chemical hazards (hazardous substances, dust, fumes, gases, solvents); biological hazards (bacteria, viruses, mould, sharps); psychosocial hazards (workplace violence, fatigue, excessive workload, bullying, traumatic events); ergonomic hazards (repetitive movements, awkward postures, prolonged static positions); and environmental hazards (weather exposure, UV radiation, uneven terrain).
Effective hazard identification draws on multiple sources: workplace inspections; task analysis (breaking work into steps and identifying hazards at each step); incident and near-miss records; consultation with workers (which the WHS Act requires); safety data sheets for chemical hazards; manufacturer and supplier information; and industry guidance from Safe Work Australia and state regulators.
Step 2: Risk Assessment
Once hazards are identified, each one needs to be assessed to determine the level of risk it presents. Risk assessment involves two variables: the likelihood that the hazard will cause harm (rated 1–5, from Rare to Almost Certain), and the consequence (severity) if it does (rated 1–5, from Insignificant to Catastrophic). Together, these determine the risk rating.
A standard 5×5 matrix produces ratings from 1 (low) to 25 (extreme): scores 1–4 are Low (monitor, address in routine cycles); 5–9 are Medium (action required, assign owner and timeline); 10–16 are High (urgent action required, escalate to management); and 17–25 are Extreme (immediate action, do not proceed until controlled).
It’s important to assess both inherent risk (pre-control, before any controls are applied) and residual risk (post-control, reflecting actual exposure given current controls). The gap between the two shows how much your controls are reducing exposure. A small gap may indicate that controls are inadequate or not functioning as intended.
Step 3: Implementing Control Measures — The Hierarchy of Controls
The WHS Act requires that risks be eliminated or minimised so far as is reasonably practicable. The hierarchy of controls is the framework for deciding how to do that. It ranks control measures from most to least effective and requires that you work through the hierarchy from the top, implementing higher-order controls wherever reasonably practicable.
Level 1 — Elimination: Remove the hazard entirely. The most effective control measure. If the hazard can be eliminated, no other controls are needed. Examples: decommissioning dangerous plant, substituting a hazardous chemical with a non-hazardous alternative, redesigning a task to remove the need to work at heights.
Level 2 — Substitution, Isolation, Engineering controls: Where elimination isn’t reasonably practicable, substitute the hazard with something less dangerous, isolate people from the hazard through physical barriers or restricted access zones, or engineer the process to reduce exposure (guarding machinery, installing ventilation, adding handrails, mechanical lifting aids).
Level 3 — Administrative controls: Manage risk through procedures, systems, and behaviour — safe work procedures (SWPs), permit-to-work systems, inductions and training, job rotation, signage. Administrative controls rely on consistent human behaviour, making them less reliable than higher-order controls. They should not be the only control measure for high or extreme risks.
Level 4 — Personal protective equipment (PPE): The last line of defence — it doesn’t eliminate the hazard, it only protects the individual if everything else fails. Hard hats, hearing protection, respiratory protective equipment, eye protection, safety footwear. PPE should not be relied on as the primary control for significant risks. Your WHS risk register should document which level of the hierarchy each control sits at — a register showing PPE as the primary control for multiple high-rated risks is a red flag.
Step 4: Documenting Your WHS Risk Register
A well-documented WHS risk register includes these fields for each entry: hazard ID; hazard description; location or activity; risk description (the potential harm); likelihood and consequence ratings (pre- and post-control); inherent and residual risk ratings; existing controls with hierarchy level noted; treatment actions with owner and due date; review date; and last reviewed date.
The quality of what you document matters as much as the structure. Vague entries like “manual handling — low risk — PPE required” don’t demonstrate that a genuine assessment has been conducted. Specific entries — describing the task, the hazard, the population exposed, the controls in place, and the rationale for the residual rating — are far more defensible in the event of an incident or audit.
State and Territory WHS Legislation: Key Variations
Most Australian jurisdictions have harmonised WHS legislation based on the Model WHS Act developed by Safe Work Australia, but there are important variations:
Harmonised jurisdictions (Model WHS Act): NSW (WHS Act 2011), QLD (WHS Act 2011), SA (WHS Act 2012), ACT (WHS Act 2011), NT (WHS Act 2011), TAS (WHS Act 2012), and Commonwealth (Comcare). In these jurisdictions, the core duty of care framework, PCBU duties, and risk management obligations are consistent.
Victoria — OHS Act 2004: Victoria has not adopted the Model WHS Act. The Occupational Health and Safety Act 2004 (Vic) remains in force, using the term “employer” rather than “PCBU” and a duty standard of “so far as is practicable” (rather than “reasonably practicable”). WorkSafe Victoria is the regulator. Victorian businesses must check obligations under the Vic OHS Act and Regulations specifically.
Western Australia — WHS Act 2020: WA adopted its own WHS Act 2020 (in force March 2022), closely modelled on the national harmonised framework but with WA-specific variations, particularly around mines (Mines Safety and Inspection Act 1994). The regulator is WorkSafe WA.
If your organisation operates across multiple states, you need to be aware of jurisdictional differences — particularly in Victoria, where the OHS Act differs meaningfully from the harmonised framework.
Psychosocial Hazards: The Growing Priority in WHS Risk Registers
Psychosocial hazards — factors in the work environment that can harm psychological health — have moved from the periphery to the centre of WHS compliance expectations. The Model WHS Regulations were amended in 2022 to explicitly include psychosocial risks, and all harmonised jurisdictions now require PCBUs to manage psychosocial hazards with the same rigour as physical ones.
Psychosocial hazards to include in your WHS risk register include: excessive workload and work pace; lack of job control; role ambiguity or conflict; workplace bullying, harassment, violence, and aggression; remote and isolated work; exposure to traumatic events (emergency services, healthcare, social work); and poor organisational support or unsupportive management culture.
Applying the hierarchy of controls to psychosocial hazards requires adaptation — you can’t install a physical barrier around excessive workload — but the principle holds. Elimination and redesign of work (addressing excessive workloads, removing bullying behaviours, redesigning roles for greater control) are higher-order controls. Training, policies, and EAP programs are administrative controls or individual-level interventions. For detailed guidance on WHS risk management, including psychosocial risk frameworks, see OHS and WHS Risk Management: A Practical Guide for Australian Businesses.
Integrating Your WHS Risk Register with Your Broader Risk Management System
A WHS risk register that sits in isolation — maintained by the safety team, never seen by the executive, disconnected from your incident management system — delivers limited value. Every WHS incident or near-miss should trigger a review of the relevant register entries: did the incident reveal an uncaptured hazard? Did it show that a control isn’t functioning as intended? The feedback loop between incidents and the risk register is what makes it a living tool.
Your highest-rated WHS risks should appear in board-level risk reporting. The board has a governance responsibility for WHS performance, and that responsibility requires visibility of the material WHS risks the organisation faces. In larger organisations, the WHS risk register may be integrated with a broader enterprise risk register so that significant safety risks sit alongside strategic and financial risks at the enterprise level.
Frequently Asked Questions
Is a WHS risk register legally required?
The WHS Act doesn’t specifically mandate a “risk register” by name, but it requires PCBUs to manage risks through a prescribed process: identify hazards, assess risks, implement controls, and review. A risk register is the standard documented form of that process. In practice, auditors, regulators, and courts expect to see documented evidence of risk assessment. For high-risk activities (confined space entry, work at heights, hazardous chemicals), specific Regulations may require documented risk assessments, which are effectively individual register entries.
How is a WHS risk register different from a SWMS?
A Safe Work Method Statement (SWMS) is a document specific to high-risk construction work. It describes the work, the hazards, and the control measures for a specific job or task. A WHS risk register is broader — it captures all workplace hazards across the organisation or site, not just high-risk construction activities. The SWMS is task-specific; the risk register is the comprehensive reference document for the workplace’s overall hazard and risk profile.
How often should a WHS risk register be reviewed?
At minimum, annually and whenever there is a change to the work, workplace, or work system that may give rise to new or different hazards. This includes: new plant or equipment, new substances or materials, changes to work processes, incidents or near-misses, and changes in key personnel. High-rated risks should be reviewed more frequently than low-rated ones. See How Often Should You Review and Update Your Risk Register? for a detailed review schedule framework.
What happens if there’s a WHS incident and we don’t have a risk register?
In the event of a serious workplace injury or fatality, the regulator will investigate and will almost certainly examine your risk management documentation. The absence of a WHS risk register — or a register that doesn’t include the hazard that caused the incident — is likely to be treated as evidence of a failure to meet the duty to manage risks. This can result in significant penalties under the WHS Act: fines of up to $3 million for corporations, and up to $600,000 (and up to 5 years’ imprisonment) for individuals for Category 1 offences.
Can I use a spreadsheet for my WHS risk register?
Yes — a spreadsheet is a common starting point, particularly for small organisations. The limitations of spreadsheets (version control, audit trail, inability to link incidents to risks, manual updating) become significant as organisations grow or as the register becomes more complex. Purpose-built risk management software addresses these limitations and makes the register more reliable, more auditable, and easier to maintain consistently.
Build Your WHS Risk Register in Lahebo
Lahebo’s risk management platform is designed to make WHS risk registers practical and sustainable. With Lahebo, you can structure your WHS risk register using the hierarchy of controls, link incidents directly to register entries so that every event triggers a risk review, track treatment actions with owners and due dates, generate board-ready WHS risk reports, and maintain a complete audit trail of every change.
Lahebo supports both WHS-specific risk registers and integrated enterprise risk management, so your workplace safety risks sit alongside your strategic, financial, and compliance risks in a single, connected system.